Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

影響: npm:@vitest/ui >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:@vitest/browser >= 5.0.0-beta.6, < 5.0.5 → 5.0.5, npm:vite-plus >= 1.0.0-rc.0, < 1.3.0 → 1.3.0

In Vitest 5, Vite's server.fs.deny is not applied as intended on Vitest's dev servers. Depending on the server, files that Vite refuses to serve by default (such as .env, private keys and certificates, .npmrc, and .git) or Vitest's own API token file (.vitest-secret-token) can be read over plain HTTP by a client that can reach the server. In Browser Mode with test.projects, a malicious website can also read .env values through the developer's browser. This only applies when Vitest runs…

在 GitHub Advisory Database 阅读

2026/10/22 04:57，GitHub Advisory Database 发布了“Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-112948。